Stories This Week
- Top Story — GPT-6 Cyber brings stronger findings and candidate fixes: OpenAI introduced GPT-6 Cyber on November 5 for selected approved Daybreak Red users.
- WorkOS's incident now has a more specific explanation.: WorkOS says independent forensic analysis validated a researcher's account linking the retrieval of sales, support and customer operational metadata to an ARTEX agent; the researcher describes an accidental escape from a benchmark environment and says the data was deleted.
- Chainalysis expanded the scope of its earlier customer-data disclosure.: The company now says names, usernames, password hashes and live tokens for all users were exposed, superseding its initially narrower account; it says it has found no evidence of access to investigation data, which is not proof that none occurred.
- A developer's “don't ask again” approval can leave a credential behind.: Apiiro found secret candidates in Claude Code permission files published to GitHub: approving an exact command can save its text, including a credential, in local settings that later enter a repository or its history.
- A browser extension reached desktop execution through Claude Dispatch.: Researcher Gal Weizman demonstrated an extension controlling the signed-in Claude web page, sending task instructions and clicking approvals that led the connected desktop agent to run code, opening Calculator on the same computer.
- Stolen application credentials give AI-assisted attackers ordinary business access.: Microsoft reports ARTEX searching public repositories for secrets and using them in follow-on cloud activity, including one case that moved from GitHub searching to Azure Key Vault data theft in five minutes; Todyl separately reports abuse of application identities on correlated infrastructure.
- CrowdStrike's acquisition agreements add two distinct kinds of assurance.: Its November 3 announcements propose bringing Fiddler's behavioral observability and Dreadnode's adversarial AI testing into Falcon, connecting evidence about what an agent does with tests of how it can fail.
- Claude Enterprise administrators can inspect requests and proposed actions using existing security tools.: Anthropic's connecting inference hooks are generally available; its beta security center offers configuration guidance rather than certification, and centralized administration is also beta.
- Google is donating open-source tools designed to keep an AI agent's work separate from other systems.: Its November 5 announcement describes donating Agent Substrate and gVisor to CNCF Sandbox: Substrate separates persistent agent state from pooled compute, while gVisor supplies a Linux-compatible sandbox for untrusted code.
- NIST's incident-management report makes shared responsibility explicit.: Published November 2, IR 8621 summarizes a workshop on incidents affecting or caused by advanced AI systems, including authorization-scoped containment, useful telemetry and coordination across developers, deployers and users.
- An agent can issue the expected refund and still issue the wrong amount.: A November 5 Amazon research preprint tests task-tampering prompt injection, where unauthorized material changes a decision within the legitimate task rather than telling the agent to abandon it.
- Signing a requirement cannot repair a mistake made before signing.: A separate November 5 preprint uses synthetic multi-agent tasks to test signed requirement handoffs and deterministic verification.
- Harmless chat history concealed commands against deliberately vulnerable Flowise installations.: Era's Greeter investigation recorded July-to-October attacks on its honeypots in which stored messages read “hello,” while per-request configuration supplied executable instructions.
- Stolen model access is becoming inventory for resellers.: Mandiant's November 3 report describes 2026 LLMJacking investigations in which compromised cloud credentials and model-access keys enabled unauthorized inference, with access sold through aggregators called LLM Mixers.
- A small replication narrows an eye-catching model-assurance claim.: MIT researchers published early work on interpreting and editing model weights; Simon Willison separately tried the no-tools game-identification examples using a local Qwen model.
- KubeCon + CloudNativeCon North America, November 9-12, Salt Lake City.: The program includes AI inference and agentic infrastructure alongside security tracks, with co-located events on Monday..
Curator's Corner
I think we should build software that can lose a dangerous capability without losing every useful service it provides. When a vulnerability appears, the response should not automatically be a choice between shutting down the application and leaving all its powers intact.
Consider an expense application. During a repair, it could still let employees view receipts and prepare claims, while payments, bulk data exports and changes to approval permissions are suspended. Route any operation that must continue through a separate verification gate, and revoke the application's direct access so it cannot bypass that route. The gate must sit outside the vulnerable component, enforcing rules and identities the component cannot rewrite.
If an application cannot disable an individual action or tool, we should build it to do so. The ability to withdraw a capability should be a design requirement, not something security teams have to invent during an incident. This means treating software as code plus the actions it is authorized to perform, and designing those actions to be independently controlled.
Red Hat's networking flaw shows why that control has to match the actual vulnerability: disabling one related feature does not remove the flaw, and packet filtering only reduces exposure. The goal is to keep a defensible subset of service available, not to declare an application safe because somebody found a switch. Some flaws will still require a shutdown.